---
title: "How to detect, analyze, and recover a hacked site"
manual: "TYPO3 Explained"
version: "12.4"
permalink: "https://docs.typo3.org/permalink/t3coreapi:security-detect-analyze-repair@12.4"
source: "Security/HackedSite/Index.rst"
rendered: "2026-10-21T15:29:37+00:00"
---

> [!WARNING]
> **Attention**
>
> TYPO3 v12 has reached end-of-life as of April 30th 2026 and
> is no longer being maintained. Use the version switcher on the top
> left of this page to select documentation for a supported version of TYPO3.
>
> Need more time before upgrading?
> You can purchase Extended Long Term Support (ELTS) for TYPO3 v12 here:
> [TYPO3 ELTS](https://typo3.com/services/extended-support-elts).

# How to detect, analyze, and recover a hacked site {#security-detect-analyze-repair}

If your TYPO3 site has been hacked, simply restoring a backup is not enough.
You must determine how the breach happened and take steps to prevent it
from recurring.

This chapter provides a structured response plan, including detection,
containment, investigation, and recovery. These actions help limit damage
and improve future resilience.

**Steps to take when a site got hacked**

-   [Detect a hacked website](https://docs.typo3.org/permalink/t3coreapi:detect-a-hacked-website@12.4)
-   [Take the website offline](https://docs.typo3.org/permalink/t3coreapi:take-the-website-offline@12.4)
-   [Analyzing a hacked site](https://docs.typo3.org/permalink/t3coreapi:analyzing-a-hacked-site@12.4)
-   [Repair/restore](https://docs.typo3.org/permalink/t3coreapi:repair-restore@12.4)
-   [Further actions](https://docs.typo3.org/permalink/t3coreapi:further-actions@12.4)